Not quite the end of uncertainty for Emerging Risks? New perspectives are coming over the horizon

These risks and their consequences are often described as emerging risks due to their velocity, uncertainty, complexity and impact – yet organisations identify and respond to them in very different ways.

This may change as organisations respond to the recent release of the first edition of ISO 31050 – Guidance for managing emerging risks to enhance resilience. With fresh regulatory standards and requirements either recently implemented or under consideration in the United States and United Kingdom, the management of emerging risks could evolve rapidly from 2024 onwards. The potential implications for risk leaders and boards should prompt organisations to look at their approaches to emerging risks and ask, are they fit for purpose?

What is an emerging risk?

Organisations use a range of different definitions for emerging risks, refined based on time horizons, risk tolerance thresholds, or tied to strategy deliverables. The WTW Research Network currently uses the International Risk Governance Council definition ^[1] for emerging risks: “a risk that is new, or a familiar risk in a new or unfamiliar context or under new context conditions (re-emerging). Emerging risks are issues that are perceived to be potentially significant but that may not be fully understood and assessed, thus not allowing risk management options to be developed with confidence that they will be effective.”

We also keep a watching brief on the definitions used by different organisations and changes in how they think about and respond to emerging risks. Variations in wordings are not a problem, so long as the activity they drive delivers value for the organisation. That starts with an understanding of where an organisation is in their risk maturity approach and appetite, and then forming an approach suited to the organisation’s capability, preferences, and overall risk framework. It also means going beyond risks to see the opportunities. Leading companies extend their emerging risks thinking into strategic change and innovation, connecting teams across their organization.

New guidance

The publication of ISO 31050 – Guidance for managing emerging risks to enhance resilience in November 2023 may prompt greater alignment of definitions for emerging risk across organisations. The overall aim of the document though is to provide guidelines for applying the ISO 31000 risk management process to emerging risks.

It will provide a reference for organisations seeking to foster best practice in the development of foresight and the delivery of insight to better understand emerging risks. With improved understanding, the guidance then aims to support organisations in making informed risk management decisions to enhance resilience and deliver value through the integration and alignment with organisational strategy. Key content in ISO 3150 includes:

1. Examples of changes in context that can give rise to emerging risks.
2. Structured processes for identifying and assessing emerging risks.
3. Frameworks and processes to treat, monitor and review emerging risks.
4. Worked examples of effective implementation of emerging risk management, with resilience indicators.

Evolving United Kingdom legal and reporting requirements

After several years deliberating reforms to audit and corporate governance, the UK government published draft regulations for consultation in July 2023, to come into force for any financial year beginning on or after 1 January 2025. The Financial Reporting Council (FRC), the independent regulator for audit and corporate reporting, was also consulting on complementary updates to the Corporate Governance Code, for implementation to the same timeframe. These included enhanced requirements the management and reporting of emerging risks.

Whilst both sets of proposals have now been stopped and a new consultation is underway, they are still worthy of consideration for lessons they might hold for best practice in emerging risks management. So, what was under discussion for emerging risks? Two key aspects:

Evolving United States reporting requirements

Renewed regulatory appetite for organisations to clarify and standardise risk reporting is also driving change for emerging risks in the United States. From 2005 the Securities Exchange Commission (SEC) required firms to disclose “the most significant factors that make the company speculative or risky” ^[6]. From the outset there was a lack of certainty around whether emerging risks should be included in disclosures and concerns that the vague wording might give rise to “boilerplate…cover all bases” risk disclosures ^[7]. In 2020 the SEC introduced new rules ^[8] to:

• Shift from “most significant factors making the company risky” to “material risks.”
• Require risks to be organised by relevant headings.
• Mandate a summary if the disclosure exceeded 15 pages.

Interpretations of these new rules are still developing and for now emerging risks remain an area of uncertainty. The term “material risks” still presents ambiguity for the treatment of emerging risks; but should prompt forward looking organisations to consider their materiality. The requirement for “risk headings” does not specify the headings or a taxonomy that companies should use. However, some of the most sophisticated submissions under the new rules employ a structured risk taxonomy linked to the firm’s Enterprise Risk Management approach ^[9]. As approaches to the new regulations mature, it is likely more firms in the US will need to refine their risk taxonomies. But for now, it seems they will have scope to decide for themselves whether emerging risks will be a valuable risk heading.

Ensuring your emerging risks approach is fit for purpose

Regardless of future regulation, organisations at the cutting edge of risk management already report the benefits of implementing processes similar to those proposed by the FRC and the release of ISO 31050 is only set to widen the adoption of emerging risk management.

Whilst the arrival of new frameworks and regulations should reduce uncertainty in the long-term, it will not suddenly mean one-size fits all: implementation will and should continue to vary according to the individual needs of organisations. This comes back to the question of the value of emerging risks management internally to organisations and the importance of a coordinated approach that supports decision-making. Regulation aside, successful emerging risks management should give leaders insights and actions that deliver advantage against competitors.

Over the coming months the Emerging Risks hub will share some of our internal work on approaches to emerging risks, from the integration of new data sources and analytics with expert judgement to the development of scenarios and the importance of effective risk communication. Also on the horizon for us is the next iteration of our Emerging and Interconnected Risks Survey, which will aim to drill down into these themes and bring new perspectives to new and familiar risks.

Footnotes

1. This definition is also recognised by the Institute for Risk Management in their 6^th edition of Fundamentals of Risk Management: Understanding, evaluating and implementing effective enterprise risk management (2022). Return to article
2. Department for Business and Trade Press Release Return to article
3. FRC Statement: Policy Update Return to article
4. The UK Corporate Governance Code 2018, Financial Reporting Council. Return to article
5. UK Corporate Governance Code Consultation Document 2023, Financial Reporting Council. Return to article
6. Regulation S-K, Item 305(c), SEC 2005. See SEC Securities Offering Reform 2005 p.257-260 for commentary on the introduction of this disclosure requirement. Return to article
7. PressReader Return to article
8. 17 CFR § 229.105 - (Item 105) Risk factors Return to article
9. SEC Risk Factor Disclosure Rules Return to article